“Prevention is great – but detection is a must.” – Kevin Hayes, CISO, Merit Network (read Blumira’s full case study).
When it comes to monitoring your full technology stack for threat detection and response, security and IT professionals have traditionally employed your typical big-vendor SIEM solution. But when those fail to provide any real security value, you may turn to seeking out a SIEM alternative.
Over a decade old, SIEM (security information and event management) solutions collect and centralize the logs of systems, devices, applications and network infrastructure. Then, in an ideal world, it provides a real-time analysis of these logs to generate security alerts that help your IT or security team detect potentially malicious activity or behavior in your environment.
The complexity of SIEMs are explained in this video and in more detail following it:
Get the full transcript here.
Traditionally, SIEMs are deployed on-premises, although cloud-delivered SIEMs are another available option these days. Requiring compute, storage and backup management, a typical SIEM solution may take up to months or even a year to fully set up, configure and parse logs in a meaningful way.
Before actually implementing a SIEM, you’ll need to conduct some discovery and planning to ensure you’ve identified key use cases and business objectives that are important to your organization, then test them out with your SIEM.
Depending on your SIEM, it may be difficult to jump directly to the log analysis stage. Some SIEMs come pre-configured with a default set of alert rules, others are integrated with threat intelligence feeds, and sometimes you may need to run ad-hoc queries to see what does and doesn’t work, according to Blumira’s Sr. Incident Response Engineer Amanda Berlin.
That process requires a lot of fine-tuning and configuration that can be resource-draining and time-intensive for your typical medium-sized organization, especially without a fully-staffed security team to set it up and maintain it. SIEMs may also generate too many false-positive alerts that cause your teams to tune out, putting you at risk of missing a critical security event.
Tailoring alerts to your specific environment will yield the best results. Getting additional context with broader log correlation across multiple hosts and systems can help inform and provide more effective security analysis.
The manual setup, configuration and maintenance of older SIEM solutions generates too much complexity and work for IT teams today, while not providing enough security value. That includes both effective threat detection and response, not just log collection.
See how security automation is leading the way for modern threat detection and response solutions:
An alternative SIEM solution should come with rules built into its platform for more automated detection. Once you set up log integrations and start ingesting them from your firewalls, VPNs, endpoint security, identity and cloud infrastructure providers, your security platform should be able to easily parse and structure them for analysis.
Blumira’s platform easily supports many integrations and parses dozens of different data types, providing updates on a weekly basis – far faster and broader than many other SIEMs that may only support a few log types and take months to push out updates.
In addition to collecting logs, a SIEM needs to correlate these logs across different security events from firewalls, endpoint solutions, antivirus, etc. With the integration of third-party intelligence feeds, a SIEM can better identify known exploits and threats to help inform what to alert your team on. Traditional SIEMs are often only used for log collection, and are typically not focused on identifying behavior associated with a threat or risk.
As seen below, Blumira’s platform prioritizes its findings to help you understand different risks, suspects (events that require further investigation), and threats (categorized by the time period you should respond). We also can surface operational events, such as high availability failover or CPU spikes, so your team is aware of any change in operational performance.
In addition to prioritization, Blumira integrates with and correlates findings with multiple threat intelligence feeds. Our security analysts perform research to scope threats and detection, then create detection rules that inform Blumira’s platform on priority threats.
Automated threat response is where many SIEMs fall flat. In the industry, this is referred to as security orchestration, automation and response (SOAR), and can take the form of additional software layered on top of a traditional SIEM. A new market term, XDR (extended detection and response) refers to a more unified incident detection and response platform, combining the capabilities of both SIEM + SOAR.
We extend the typical capabilities of a traditional SIEM with automation to ease the burden on your IT teams and make security management more cost-effective for organizations. Blumira’s automated threat response is integrated with its SIEM, log analysis, correlation and detection – all in one platform.
You can respond to threats with automated, one-click block lists delivered through firewall integrations, or take action to ensure connections are not allowed from the internet to reduce your overall attack surface. Our platform also provides easy, step-by-step guidance on remediation and next steps for small teams, no security expertise required.
Blumira gives you an easy tool to detect attacker access attempts and lateral movement through your environment with honeypots. Designed to bait attackers and insiders alike, a honeypot can replicate a login page, detect any unauthorized access and send an alert to your team. See how Blumira’s honeypot detected a spike in RDP access attempts from external sources across the globe, and learn more about how to configure Blumira honeypots.
Learn more about what to look for in an alternative SIEM solution:
A Guide to Replacing Your SIEM – Our guide gives you a criterion checklist to help you select a modern security platform that can meet your organization’s needs, without significant overhead.
How Much is Your SIEM Solution Costing You? – Estimate the total cost of ownership of your SIEM with our cost tables, including all the hardware, software, support, professional services, personnel, etc. to both deploy and maintain a traditional SIEM.
